{"id":"30acc35b-9bc1-42cc-98d7-cd79d87141e7","arxiv_id":"2501.15363","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"A Vision Transformer trained on key-scrambled medical images achieves 94% validation accuracy and appears robust to simple noise and reconstruction attacks.","lead":"This paper proposes a way to classify encrypted medical images using a Vision Transformer combined with a key-based pixel scrambling method. The authors report 94% validation accuracy on brain tumor and lung/colon cancer images and say the method resists several simple attacks.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Confidentiality claim rests on an unvalidated key-secrecy assumption: the per-client deterministic block-pixel encryption is never tested against known-plaintext or statistical reconstruction attacks, so the privacy-preserving central claim is not established.","rationale":"The reader's verdict is sound: the classification accuracy numbers are plausible and the engineering contribution (ViT on key-scrambled medical images) may hold, but the advertised privacy guarantee is not established. My stress-test focuses on the confidentiality half of the central claim because the novelty and 'trustworthy' framing depend on it. The attack evaluation is purely qualitative: Figure 4 shows example images without quantitative metrics, no comparison to prior encryption schemes, and no explicit threat model. The stated assumption in Section IV-D excludes key knowledge but not known-plaintext or statistical adversaries. Because each client uses one key for all images, the encryption is deterministic per client, which makes key-reuse attacks relevant; the paper does not discuss this. A known plaintext-ciphertext pair can in principle reveal the per-patch permutations and masks, and even a weaker histogram-based reconstruction may recover recognizable structure because pixel-value multisets are preserved. This concern follows directly from the construction in Eqs. (2)-(6), not from an external consensus. If the proposed known-plaintext or statistical test succeeds, the central privacy claim fails; if the test fails, the conditional verdict can be upgraded to acceptance. Therefore I keep the reader's CONDITIONAL verdict rather than moving to ACCEPT or REJECT, because the accuracy claim is credible but the security claim still needs a concrete demonstration.","tokens_in":8170,"tokens_out":5156,"duration_ms":53341,"concrete_test":"Run a known-plaintext key-recovery test on one client's encrypted dataset: (1) take one original MRI image from a public set, encrypt it with the client's key; (2) use this plaintext-ciphertext pair to estimate the key's patch shuffle, intra-patch pixel permutation, inversion mask, and channel shuffle (e.g., by matching patch color histograms and pixel correspondences); (3) apply the recovered inverse transformation to a held-out encrypted image from the same client and compute PSNR and SSIM against the original. If PSNR exceeds about 30 dB or SSIM exceeds about 0.9, the confidentiality claim fails under a standard known-plaintext assumption. Additionally, run a no-key statistical baseline attack: replace each encrypted pixel's value and channel by its most likely original value using a public medical-image prior and report PSNR/SSIM; compare with the qualitative claims in Figure 4.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central privacy claim (Section IV-D) is that an adversary who knows the encryption algorithm but not the client's key cannot reconstruct the medical images. This is not established: the only evidence consists of two heuristic attacks (Leading Bit and Minimum Difference) shown as example images in Figure 4, with no PSNR/SSIM, no baseline comparison, and no threat model that specifies adversarial capabilities. More specifically, the encryption in Eqs. (2)-(6) is a deterministic, keyed permutation and inversion applied per client and reused across all images from that client. Because it preserves the multiset of pixel values and operates on small 25x25 patches, it leaves global color statistics and local patch statistics partially intact. An adversary with access to one known plaintext-ciphertext pair for a client's key could in principle recover the per-patch permutations, inversion masks, and channel shuffles, then decrypt every other image encrypted under that same key; the paper neither rules this out nor even discusses known-plaintext adversaries. Even without a known plaintext, a statistical reconstruction attack using a public medical-image prior could plausibly recover recognizable structure, and the paper provides no quantitative evidence against it. Thus the 'trustworthy and privacy-preserving' claim is load-bearing on an assumption that is asserted but never tested.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a framework for privacy-preserving medical image classification that combines a keyed block-pixel learnable encryption scheme with a Vision Transformer (ViT) classifier. Each client encrypts local images using a client-specific key via patch scrambling, patch shuffling, negative-positive inversion, and channel shuffling; the encrypted images are then classified by a ViT on a central server. The authors report 95% training and 94% validation accuracy on encrypted MRI brain tumor and lung/colon histopathology datasets, plus robustness to Gaussian noise and bit-flip integrity attacks, and resistance to two heuristic reconstruction attacks (Leading Bit and Minimum Difference). The core claims are that the framework preserves classification accuracy in the encrypted domain and provides confidentiality of medical images under key secrecy.","tokens_in":8436,"tokens_out":2495,"duration_ms":24672,"significance":"If the confidentiality and robustness claims were rigorously established, the framework would be a useful practical contribution to privacy-preserving medical image analysis, particularly because it avoids heavy cryptographic primitives and claims computational efficiency. The combination of a transformer with block-pixel encryption is a plausible design direction, and the reported accuracy on encrypted medical images is higher than typical baselines in this area. However, the significance is currently limited by the absence of a formal or even a quantitatively rigorous security evaluation: the confidentiality claim rests on two qualitative attack demonstrations, and the empirical accuracy results are reported without variance, hyperparameters, or a fair baseline comparison. The paper's value proposition—\"trustworthy and privacy-preserving\"—is therefore not yet supported to the standard expected for a security-adjacent venue.","major_comments":[{"comment":"The central confidentiality claim is not substantiated. The only evidence is Figure 4, which shows example images after the Leading Bit and Minimum Difference attacks, with no quantitative metrics (e.g., PSNR, SSIM, or classification of reconstructed images) and no comparison to a baseline or to attacks on plaintext images. The sentence \"preventing the reconstruction of original images and demonstrating its robustness\" is a visual assertion, not a security evaluation. The paper needs a defined threat model (adversary capabilities, access to ciphertexts, known/plaintext knowledge) and quantitative reconstruction-resistance measures, ideally including attacks that exploit the structure of the scheme.","section":"Section IV-D, Confidentiality Evaluation"},{"comment":"The encryption scheme is a deterministic keyed permutation and inversion that preserves the multiset of pixel values and operates on small 25×25 patches. Because each client reuses the same key for all of their images, a known-plaintext attack on a single image would in principle reveal the per-patch permutation, inversion mask, and channel shuffle, enabling decryption of every other image encrypted with that key. The paper neither discusses this adversary nor provides any argument that the scheme resists it. Since Section IV-D explicitly assumes the adversary knows the encryption algorithm but not the key, the known-plaintext scenario is within the stated threat model and must be addressed.","section":"Section III-A, Eqs. (2)-(6)"},{"comment":"The comparison against DNN baselines is not controlled. The DNN models are evaluated under \"Pixel Shuffling\" encryption while the proposed framework uses the full block-pixel encryption; the table therefore conflates the effect of the ViT architecture with the effect of the encryption method. To support the claim that the proposed framework outperforms traditional DNNs in the encrypted domain, the baselines must be trained under the same learnable encryption scheme, or at least the comparison must be reported as a joint architecture-plus-encryption evaluation rather than a head-to-head of the classifiers.","section":"Table II and Section IV-C"},{"comment":"All empirical accuracy figures are reported without error bars, repeated runs, or hyperparameter settings (learning rate, batch size, number of epochs, optimizer, patch embedding dimension). The 94% validation accuracy may be a single run, so it is not possible to assess the stability of the result or whether the confidence intervals overlap with the DNN baselines. The paper should report mean and standard deviation over multiple random seeds and list the training hyperparameters.","section":"Section IV-A and Table I"},{"comment":"The integrity evaluation is limited to 10% and 20% perturbation of training data, with the statement that \"strategic attackers don't poison the full data as too much perturbation generates more correlated alerts.\" This is an unproven assumption about attacker behavior. A stronger adversary could poison a larger fraction or target the validation/test distribution, and the robustness claim should be bounded by the attack fraction actually tested. Please either test stronger perturbations or explicitly state the attack model under which the 85-90% accuracy holds.","section":"Section IV-D, Integrity Evaluation"}],"minor_comments":[{"comment":"Eq. (1) writes \"64 = 200×200 / 252\", which appears to be a typesetting error for 25^2 (the patch area). Please correct the notation to avoid confusion.","section":"Section III-A, Eq. (1)"},{"comment":"Eq. (4) contains \"x&if r = 0\", which should read \"x if r = 0\". The ampersand is a typographical artifact.","section":"Section III-A, Eq. (4)"},{"comment":"The manuscript repeatedly uses \"it's\" where \"its\" is meant (e.g., \"it’s robustness\" in Section IV-D, \"it’s capability\" in the abstract). Please proofread for possessive forms.","section":"Abstract and Section IV-D"},{"comment":"The dataset description states \"5,712 MRI images (with 1,311 used for testing)\" and \"2,980 histopathological images (with 311 for testing)\". Please clarify whether these are after train/test split and whether the splits are stratified, so that the reported accuracies are interpretable.","section":"Section IV-B"},{"comment":"The related-work section discusses prior learnable encryption schemes but does not cite several closely related ViT-based encrypted-domain works (e.g., Kiya et al. is cited as [8], but the discussion of block-wise encryption for ViTs would benefit from a more direct comparison with recent transformer-based privacy-preserving methods). Please expand the comparison to position the contribution more precisely.","section":"Section II-B"}],"recommendation":"major_revision","confidential_remarks":"The paper is a straightforward application of a known learnable-encryption idea (block-wise scrambling plus pixel transformation) to a ViT backbone. The main novelty is the integration, but the security analysis is far weaker than the claims. The confidentiality evaluation is essentially a visual inspection of two heuristic attacks, and the vulnerability to known-plaintext recovery is a serious gap given the per-client key reuse. I would not recommend rejection, as the empirical accuracy is plausible and the framework could be made sound with added threat modeling, quantitative reconstruction metrics, and a controlled baseline. However, the current version does not meet the standard for a security-oriented publication; the authors should be asked for major revisions including new experiments and a significant rewriting of the security claims."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a reasonable applied result — a Vision Transformer trained on block-pixel encrypted medical images reaches 94% validation accuracy on brain MRI and lung/colon histopathology. The integrity experiments (Gaussian noise, bit-flip at 10/20%) are simple but honestly reported. What is not established is the confidentiality claim, and that is the paper's central selling point.\n\nThe genuinely new bit is the combination: multi-step block-pixel encryption (patch scrambling, patch shuffle, pixel inversion, channel shuffle) with ViT, plus adversarial tests on the encrypted training data. Prior work used DNNs with block-wise encryption; showing ViT handles this better (95% vs 38-51% on encrypted MRI) is a useful data point, even though the comparison uses only plain pixel-shuffling for the baselines rather than the full proposed encryption.\n\nThe soft spots are concentrated in Section IV-D. The privacy argument is: an attacker who knows the encryption algorithm but not the key cannot reconstruct the image. The only evidence is two heuristic attacks (Leading Bit, Minimum Difference) shown as example images in Figure 4, with no PSNR/SSIM, no baseline, and no threat model. The stress-test concern is on point: the encryption is deterministic and key reuse per client means a single known plaintext-ciphertext pair could plausibly reveal the per-patch permutation, inversion mask, and channel shuffle, after which every other image from that client decrypts. The paper never discusses known-plaintext adversaries. It also preserves the multiset of pixel values and small-patch statistics, so a statistical reconstruction attack with a medical-image prior is not addressed. The claim that reconstruction is 'infeasible' is therefore unsupported.\n\nThe empirical side is also under-supported: no error bars or repeated runs, no hyperparameters, no code. The 94% figure is plausible but not pinned down.\n\nWho this is for: someone working on privacy-preserving medical image classification who wants a concrete ViT baseline and a reminder that adversarial robustness needs quantitative evaluation. It is not a trustworthy security analysis. That said, the paper is coherent and the experiments are real, so it deserves a serious referee — I would send it to peer review with the expectation of major revision, asking for a proper threat model, known-plaintext analysis, quantitative reconstruction metrics, and code/data release.","headline":"Plausible applied result for ViT on encrypted medical images, but the confidentiality guarantee is asserted rather than demonstrated and needs a real threat model.","tokens_in":8931,"tokens_out":2800,"would_cite":false,"duration_ms":24383,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that a Vision Transformer trained on medical images encrypted by a key-dependent block-pixel scrambling scheme reaches 94% validation accuracy and resists the tested noise and reconstruction attacks.","keywords":["Privacy-preserving data sharing","Learnable encryption","Block-pixel operation","Vision Transformer","Medical image classification","Adversarial robustness","Data integrity","Confidentiality"],"falsifier":"Give an adversary one plaintext–ciphertext pair produced under a single client's key and check whether they can recover the key-driven permutation of pixels, patch shuffle, inversion mask, and channel shuffle; if they can, every other image encrypted under that key is decryptable and the confidentiality claim fails. A weaker test is to run a stronger reconstruction attack than the two demonstrated, such as a learned inversion network trained on the encrypted images, and see whether recognizable or class-revealing images emerge.","tokens_in":7995,"feed_emoji":"🔐","tokens_out":13113,"duration_ms":99396,"temperature":0.7,"pith_summary":"The paper sets out to show that medical images can be encrypted with a simple key-dependent block-pixel scrambling scheme and still be classified accurately by a Vision Transformer, without needing to decrypt them. It reports 95% training and 94% validation accuracy on encrypted MRI brain tumor and lung/colon histopathology images, close to the plain-image accuracy of standard CNNs, and 84–90% validation accuracy when 10–20% of the encrypted training set is corrupted by bit-flip or Gaussian noise. If true, this would make cloud-based diagnostic services feasible on sensitive medical data while keeping the images encrypted end to end. The paper also claims that the two reconstruction attacks it tried, Leading Bit and Minimum Difference, do not recover recognizable images, supporting the confidentiality side of the proposal.","feed_headline":"Key-scrambled medical scans classify at 94 percent","feed_subtitle":"A vision transformer keeps encrypted medical image accuracy near plain levels and survives noise attacks.","key_machinery":"The load-bearing mechanism is the block-pixel learnable encryption pipeline followed by Vision Transformer processing. An input image is divided into 64 patches of size $25 \\times 25 \\times 3$; each patch's pixels are permuted under key $K$, patch positions are shuffled by a key-driven permutation $\\sigma$, pixel values are conditionally inverted via $x' = 255 - x$, and RGB channels are permuted, after which the patches are reassembled into the encrypted image. The encrypted image is then embedded as 768-dimensional patch vectors with positional encodings and processed by transformer encoder layers of multi-head self-attention and MLPs, with a classification token read out by a softmax head. The encryption hides visual content per client key while preserving enough structure for the transformer to learn classification.","core_discovery":"The central claim is that the combination of a learnable block-pixel encryption and a Vision Transformer forms a workable and efficient privacy-preserving pipeline for medical image classification. On encrypted MRI brain tumor and lung/colon histopathological datasets, the pipeline reaches 95% training and 94% validation accuracy, close to the plain-image accuracy of the standard CNN baselines, while ResNet50, MobileNetV2, and InceptionV3 drop to 38–51% on the same encrypted inputs. Under integrity attacks, with 10% and 20% bit-flip and Gaussian noise injected into the encrypted training data, validation accuracy stays between 84% and 90%. The paper further reports that Leading Bit and Minimum Difference reconstruction attacks fail to recover recognizable images, on the stated assumption that the adversary knows the encryption algorithm but not the client's key.","pith_inferences":["The security result is only as strong as key secrecy: the encryption is a deterministic keyed permutation pipeline, so any leak or reuse of a client's key makes the transformations invertible and the confidentiality claim void.","Because the same key is used across many images for a client, a known-plaintext attack with one original/encrypted pair could in principle recover the per-key permutation, patch shuffle, inversion mask, and channel shuffle; testing this would define the real security boundary.","The reported robustness may partly reflect ViT's general tolerance to input corruption rather than properties of this specific encryption; comparing a plain-image ViT under identical noise would isolate the encryption's contribution.","The patch size and image size are tied to the medical datasets used, so whether the accuracy gain over CNNs survives on larger or higher-resolution images is an open, testable question."],"forward_implications":["Medical images can be classified in the encrypted domain at near-plaintext accuracy, so cloud services could run diagnostic models without ever decrypting the data.","The framework keeps validation accuracy between 84% and 90% when 10% or 20% of the encrypted training data is corrupted by bit-flip or Gaussian noise, indicating tolerance to integrity attacks.","Standard CNNs fall to 38–51% accuracy on encrypted images while the ViT-based approach reaches 94%, suggesting transformer architectures are better suited to this encrypted representation.","Training the proposed model takes about 82 minutes versus 185–542 minutes for the CNNs on encrypted data in the reported setup, so the approach claims both accuracy and computational efficiency.","The two reconstruction attacks tested, Leading Bit and Minimum Difference, do not recover recognizable images from the encrypted data, supporting the confidentiality claim under the stated key-unknown adversary model."],"supporting_citations":[{"why":"Shows that block-wise encrypted images degrade DNN performance and lack adversarial testing, motivating the proposed ViT-based framework.","marker":"[8]"},{"why":"Defines the learnable image encryption approach on medical images and supplies the Leading Bit and Minimum Difference reconstruction attacks used in the security evaluation.","marker":"[9]"},{"why":"Supplies the Vision Transformer architecture (patch embedding, transformer encoder, classification token) that the framework integrates with the encryption.","marker":"[18]"},{"why":"Provides the lung and colon cancer histopathological image dataset used for the reported validation accuracy.","marker":"[19]"},{"why":"Provides the brain tumor MRI dataset used for the reported validation accuracy and the DNN comparison.","marker":"[20]"}],"fun_headline_variants":["Encrypted MRI and histology: Vision Transformer hits 94%","Key-scrambled medical images classify at 94% with ViT","Vision Transformer keeps encrypted medical scans at 94% accuracy","94% accuracy from ViT on key-scrambled medical images","Block-pixel encryption lets ViT read encrypted scans at 94%"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The privacy claim depends on an adversary knowing the encryption algorithm but not the client's key; the paper asserts, rather than proves, that without the key the scrambling, inversion, and channel shuffles cannot be reversed or used to infer the original medical image.","fun_headline_variants_meta":{"raw":{"variants":["Encrypted MRI and histology: Vision Transformer hits 94%","Key-scrambled medical images classify at 94% with ViT","Vision Transformer keeps encrypted medical scans at 94% accuracy","94% accuracy from ViT on key-scrambled medical images","Block-pixel encryption lets ViT read encrypted scans at 94%"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000493,"raw_usage":{"total_tokens":2400,"prompt_tokens":903,"completion_tokens":1497,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":519,"completion_tokens_details":{"reasoning_tokens":1420}},"tokens_in":519,"tokens_out":1497,"duration_ms":10466,"temperature":1.0,"reasoning_tokens":1420,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T14:20:45.795871+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Give an adversary one plaintext–ciphertext pair produced under a single client's key and check whether they can recover the key-driven permutation of pixels, patch shuffle, inversion mask, and channel shuffle; if they can, every other image encrypted under that key is decryptable and the confidentiality claim fails. A weaker test is to run a stronger reconstruction attack than the two demonstrated, such as a learned inversion network trained on the encrypted images, and see whether recognizable or class-revealing images emerge.","supporting_citations":[{"cited_title":"Block-wise encryption for reliable vision transformer models,","cited_arxiv_id":null,"evidence_quote":"Shows that block-wise encrypted images degrade DNN performance and lack adversarial testing, motivating the proposed ViT-based framework."},{"cited_title":"Privacy- preserving deep learning with learnable image encryption on medical images,","cited_arxiv_id":null,"evidence_quote":"Defines the learnable image encryption approach on medical images and supplies the Leading Bit and Minimum Difference reconstruction attacks used in the security evaluation."},{"cited_title":"Lung and colon cancer histopathological im- ages","cited_arxiv_id":null,"evidence_quote":"Provides the lung and colon cancer histopathological image dataset used for the reported validation accuracy."},{"cited_title":"Brain tumor mri dataset,","cited_arxiv_id":null,"evidence_quote":"Provides the brain tumor MRI dataset used for the reported validation accuracy and the DNN comparison."}],"review_version":1}